WP Manifestindependent plugin directory
manifest / developer / site-config-json-api

Site Config JSON API WP RegistryMedium-severity findings · 2 findingsOpen the reportB

by Brian Wood (Stratifi Creative) · github.com/mintcondition/site-config-json-api

★ 1stars
0.5.1latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mintcondition/site-config-json-api/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/mintcondition/site-config-json-api ↗
Allows connection to an API endpoint delivering SiteConfiguration via JSON. IMPORTANT NOTE: This exposes a good bit of your site configuration to anyone with an endpoint. The only authentication is through the built in API key system. It is NOT meant for production sites or ones that you care about securing. Why would you want to use this? Well, this will allow you te generate JSON describing a lot about your site, for example, it gives info on CPTs and ACF meta fields attached to those CPTs. This can be handy when working with something like ChatGPT or another system. Instead of having to remember exactly what post and field Keys you need when asking for a code block, you can just hit the API endpoint and get a current list of them all. Feed that to ChatGPT and ask your questions. "Please modify the main query for the Events posts so that it sorts by the Event Start Date and only shows events in the future." ChatGPT will understand that Events uses the post key "mysiteevts" and the field it needs to work with is "evtstartdate". There are other reasons you might use this as well. If you can't figure out how to install a WP Plugin, you should NOT use this one. Fix for na

Releases

7 releases.

Tag
Published
0.5.1 latest
May 31, 2024 2 years ago
0.5.0
May 29, 2024 2 years ago
0.2.3
May 27, 2024 2 years ago
0.1.1
May 27, 2024 2 years ago
0.1.0
May 27, 2024 2 years ago
0.0.3
May 27, 2024 2 years ago
0.0.2
May 27, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Site Config JSON API 0.5.1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
0.5.1
Findings
2
Worst severity
medium
Content hash
6d9eb6d93f45ba2c57f01fa8…

Findings

  • medium CSRF on delete_api_key (no nonce)

    csrf

    delete_api_key checks manage_options but not a nonce, and the admin UI links via GET admin-post.php?action=delete_api_key&key=..., so a logged-in admin visiting an attacker page can delete keys.

    includes/api-key-management.php:143-158

    Recommendation

    Use check_admin_referer and POST forms for key deletion.

  • low Main endpoint echoes API key and admin_email

    information_disclosure

    get_main_endpoint embeds the request api_key into instructions text and returns admin_email in site_info. Anyone with a valid key learns the admin email and may leak the key via logs/referrers.

    includes/api-endpoints.php:57-88

    Recommendation

    Do not echo secrets; minimize PII in API responses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →